Overview

overview

10

Static

static

10

2288-58-0x...ry.exe

windows7-x64

1

2288-58-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    2288-58-0x000000001E260000-0x000000001E2E1000-memory.dmp

  • Size

    516KB

  • MD5

    3c4d94e26a780b2446e1b58dd19cb834

  • SHA1

    2146d3ef299dd7baba69694be4ba7054b647d6cf

  • SHA256

    9588ccffd20a3f6d0f65a20289d173a70756d4048e3a1d7a479725f62907bdaa

  • SHA512

    e1511c4aeb45eac148b522d57f8077f6bfe42aacb3041a74ab13961c5df020da85dd3a3f1316f2a499f0d0cd862da007f4830515eb279653b9f983696c9fbbce

  • SSDEEP

    12288:Sh59p1hyj7ulv/Lu+qQiOlOcSK+TEOLyQnXos/ZSaSDU:Sv9/hyWZu+qQiM6EWywZf

Score
10/10
miracle days (faith)remcos

Malware Config

Extracted

Family

remcos

Botnet

MIRACLE DAYS (FAITH)

C2

pentester0.accesscam.org:56796

pentester02.duckdns.org:2256
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    onedrive.exe

  • copy_folder

    onedrive

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    ONE-A9HB5W

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos family
    remcos
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2288-58-0x000000001E260000-0x000000001E2E1000-memory.dmp
    .exe windows:5 windows x86


    Headers

    Sections